MCRcortex / nekodetector

Nekoclient infection detector
MIT License
566 stars 40 forks source link

improve stage 2 detection #50

Open getchoo opened 1 year ago

getchoo commented 1 year ago

previously, this function made a few errors such as checking for a microsoft edge folder in APPDATA and not LOCALAPPDATA, checking for the known files in the startup folder (they will never be there, see here. i'm also pretty sure this was incorrectly targeting C:\Microsoft), not accounting for files besides lib.jar on linux in ~/.config/.data (client.jar for example is placed there by lib.jar here), and not checking for the registry keys or systemd services also placed by stage 2

i've tested this on both platforms and it seems to be working as expected